@helm-protocol/ttt-mcp 0.4.3 → 0.4.5

package/dist/index.js

@@ -105,7 +105,7 @@ function toolSuccess(result) {
   return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 }
 function buildMcpServer() {
-  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.3" });
+  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.4" });
   const registerTool = s.tool.bind(s);
   registerTool(
     "pot_generate",
@@ -304,12 +304,13 @@ async function main() {
     const requestHandler = async (req, res) => {
       if (req.method === "GET" && (req.url === "/health" || req.url === "/ping")) {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.3" }));
+        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.4" }));
         return;
       }
       if (req.method === "POST") {
         const apiKey = (0, import_auth.resolveApiKey)(req.headers["x-api-key"]);
-        const clientIp = req.headers["x-forwarded-for"]?.split(",")[0].trim() || req.socket.remoteAddress || "unknown";
+        const trustProxy = process.env.TTTPS_TRUST_PROXY === "1";
+        const clientIp = (trustProxy ? req.headers["x-forwarded-for"]?.split(",")[0].trim() : "") || req.socket.remoteAddress || "unknown";
         const rl = (0, import_auth.checkRateLimit)(apiKey, clientIp);
         if (!rl.allowed) {
           res.writeHead(429, {

package/dist/pot_record_v2.js

@@ -21,6 +21,8 @@ __export(pot_record_v2_exports, {
   HOLDER_AUTH_ED25519: () => HOLDER_AUTH_ED25519,
   HOLDER_AUTH_SHARED_SECRET: () => HOLDER_AUTH_SHARED_SECRET,
   POT_V2_INTEGRITY_SHA256: () => POT_V2_INTEGRITY_SHA256,
+  POT_V2_ISSUER_SIGNATURE_SIZE: () => POT_V2_ISSUER_SIGNATURE_SIZE,
+  POT_V2_SIGNED_PREFIX_SIZE: () => POT_V2_SIGNED_PREFIX_SIZE,
   POT_V2_SIZE: () => POT_V2_SIZE,
   POT_V2_VERSION: () => POT_V2_VERSION,
   computeV2BindingInput: () => computeV2BindingInput,
@@ -35,6 +37,8 @@ var import_crypto = require("crypto");
 const POT_V2_SIZE = 180;
 const POT_V2_VERSION = 2;
 const POT_V2_INTEGRITY_SHA256 = 1;
+const POT_V2_SIGNED_PREFIX_SIZE = 116;
+const POT_V2_ISSUER_SIGNATURE_SIZE = 64;
 const HOLDER_AUTH_ED25519 = 1;
 const HOLDER_AUTH_SHARED_SECRET = 2;
 const OFF = {
@@ -72,7 +76,7 @@ function encodePotRecordV2(fields, issuerPrivateKey) {
   requireLength("ctx_id", fields.ctxId, 16);
   requireLength("nonce", fields.nonce, 16);
   requireLength("holder_auth_data", fields.holderAuthData, 32);
-  const prefix = Buffer.alloc(116);
+  const prefix = Buffer.alloc(POT_V2_SIGNED_PREFIX_SIZE);
   prefix.writeUInt8(POT_V2_VERSION, OFF.VERSION);
   prefix.writeUInt8(fields.holderAuthType, OFF.HOLDER_AUTH_TYPE);
   prefix.writeUInt16BE(fields.algId, OFF.ALG_ID);
@@ -88,7 +92,9 @@ function encodePotRecordV2(fields, issuerPrivateKey) {
 }
 function decodePotRecordV2(record) {
   if (record.length !== POT_V2_SIZE) throw new Error(`expected 180 octets, got ${record.length}`);
-  const signedPrefix = record.subarray(0, 116);
+  const signedPrefix = record.subarray(0, POT_V2_SIGNED_PREFIX_SIZE);
+  const issuerSig = record.subarray(POT_V2_SIGNED_PREFIX_SIZE, POT_V2_SIZE);
+  requireLength("issuer signature", issuerSig, POT_V2_ISSUER_SIGNATURE_SIZE);
   return {
     holderAuthType: record.readUInt8(OFF.HOLDER_AUTH_TYPE),
     algId: record.readUInt16BE(OFF.ALG_ID),
@@ -99,7 +105,7 @@ function decodePotRecordV2(record) {
     holderAuthData: Buffer.from(record.subarray(OFF.HOLDER_AUTH_DATA, OFF.HOLDER_AUTH_DATA + 32)),
     issuerKeyId: record.readUInt32BE(OFF.ISSUER_KEY_ID),
     integrityTag: Buffer.from(record.subarray(OFF.INTEGRITY_TAG, OFF.INTEGRITY_TAG + 32)),
-    issuerSig: Buffer.from(record.subarray(OFF.ISSUER_SIG, POT_V2_SIZE)),
+    issuerSig: Buffer.from(issuerSig),
     signedPrefix: Buffer.from(signedPrefix)
   };
 }
@@ -163,6 +169,8 @@ function verifyPotRecordV2(record, issuerPublicKeyRaw, freshness) {
   HOLDER_AUTH_ED25519,
   HOLDER_AUTH_SHARED_SECRET,
   POT_V2_INTEGRITY_SHA256,
+  POT_V2_ISSUER_SIGNATURE_SIZE,
+  POT_V2_SIGNED_PREFIX_SIZE,
   POT_V2_SIZE,
   POT_V2_VERSION,
   computeV2BindingInput,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helm-protocol/ttt-mcp",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Proof-of-Time attestation — Ed25519-signed timestamps with multi-source corroboration and explicit error bounds. IETF draft-helmprotocol-tttps",
   "main": "dist/index.js",
   "bin": {